csocommit 7dc2f23 · v3.0.0SKILL.md · Security Audit
gstack CSO Security Audit
Evidence-first security audit via the gstack-cso helper that reports supported findings; comprehensive mode adds reproduction and repair candidates.
Requires the gstack-cso launcher; comprehensive mode runs the app in local Docker, and redacted reports are kept for 30 days.
npx skills add garrytan/gstack --skill csoCommand selected. Copy it manually.
- Permissions
- read-repo
- write-files
- shell
- network
- Compatible with
- Claude Code, Codex, Cursor, Copilot
- GitHub
- 138.5k
- Source
- Community · Garry Tan
- Status
- Scan passed
- License
- MIT
- Category
- Security Audit
- Repository
- github.com/garrytan/gstack/cso
Core rule
Evidence before assurance: report only findings with an attacker-controlled entrypoint, a crossed security boundary and demonstrated impact.
Execution Phases
Phase 01Resolve mode and start
Resolve scope and flags, start exactly one run through the trusted launcher, and read source only via the helper's inspect, read and history.
Phase 02Model and census
Map actors, assets, entrypoints, tenant boundaries and security invariants, and record the attack surface such as endpoints, uploads, webhooks and CI/CD.
Phase 03Run scoped phases
Run the audit phases for the selected scope, such as infrastructure, code, skills, supply chain or OWASP.
Phase 04Evidence and challenge
Judge severity, confidence and evidence separately, challenge each candidate with an independent reviewer or a separate skeptical pass, and sweep sibling sites.
Phase 05Report and recheck
Open the report with complete, partial or not assessed, show a findings table, persist it via the helper, and use resume, replay or recheck later.
Permissions (summarised from SKILL.md)
| Capability | Needed | Details |
|---|---|---|
| File writes | Not required | Does not change the branch or project source; the helper stores reports and repair candidates in a private state directory. |
| Command execution | Limited | Only the gstack-cso launcher may run; target tools and Docker are never run directly on the host. |
| Network outbound | Limited | Queries only public package and advisory IDs; --offline disables all network access. |
SKILL.md frontmatter (YAML)
---
name: cso
version: 3.0.0
description: "Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)"
allowed-tools:
- "Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)"
- "Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher.exe *)"
triggers:
- security audit
- check for vulnerabilities
- owasp review
---